Conformance Audit Template/Help - Audit of my QMS to the ISO standard

[Dee3712]

HI! First post, long time "lurker". During my last certification audit the auditor asked me about my "conformance audit". Having no idea what he was talking about he explained that I needed to have documentation of an audit of my QMS to the ISO standard and the various regulations I state we conform to. I've searched for a template of a "conformance" or "compliance" audit and only found a 28 pager. How have others met this obligation Or is my auditor going "overboard"?

[AndyN]

Originally Posted by Dee3712

HI! First post, long time "lurker". During my last certification audit the auditor asked me about my "conformance audit". Having no idea what he was talking about he explained that I needed to have documentation of an audit of my QMS to the ISO standard and the various regulations I state we conform to. I've searched for a template of a "conformance" or "compliance" audit and only found a 28 pager. How have others met this obligation Or is my auditor going "overboard"?

Overboard!

Is there a requirement, clearly stated in 13485?? I haven't got it open in front of me......

However, it may be that the auditor is 'fishing' for you to make your internal audit program a little stronger in some respect. Often, the auditor's thoughts come out (verbally) differently to the intentions! Do you cover regulatory requirements when you do your internal audits? Do you ensure your audit program has some feature of ensuring compliance to the ISO 13485 requirements? If not, then you've got work to do!

As for doing a 'stand alone' conformance audit - it appears to me to be a personal wish....

[cclee]

Hi, we had a similar minor nonconformance from our third party auditor for not assessing our quality management system against requirements of MDD. It was our misconception that assessment to the requirements of MDD was not required because we currently do not have any CE marked devices in the EU market even though we still maintain the procedures and certificate.

As a result, we added MDD requirements in the audit schedule, audit reports and audit checklists in the audit criteria, and provided documented evidence that we have assessed our QMS(audit topics) against the stated standard.

Characteristics of Conformance Audit (referenced in ASQ CQA-study Module 1 section C):
"Conformance audits are designed to give assurance that activities have been performed according to stated rules. Such audits do not question the rules themselves but verify implementation of written procedures, requirements, or standards"

Hope this helps,
cclee

[Vincnet]

Hello Dee,
I came accross this one recently, in fact you need to address in your internal audits conformance to any regulations that you need to comply to in order to be allowed to market in a specific country. in other words you need an audit Check-List for the MDD directive an other one for the CMDCAS an other one for Japan, an opther one for 21CFR part 820 according to the countries you are marketing your devices in.
the following are extracted from ISO 13485 and 14969
ISO 13485 promotes the adoption of a process approach when developing, implementing and improving the effectiveness of a quality management system, with the objective of meeting customer and regulatory requirements and providing medical devices that meet customer and regulatory requirements.

Conformance to ISO 13485 quality management system requirements does not automatically constitute conformity with national or regional regulatory requirements. It is the organization’s responsibility to identify and establish compliance with relevant regulatory requirements.

4.2 Documentation requirements
4.2.1 General
The quality management system documentation shall include
f) any other documentation specified by national or regional regulations
5.6.2 Review input
The input to management review shall include information on
h) new or revised regulatory requirements.
The management review is intended to see if ...regulatory requirements are
being met.


More over ISO 14469 explains:

For the purposes of management review and even for the purposes of design input (see 7.3.2 of ISO 13485), the “regulatory requirements” referred to are any laws published or otherwise enacted by any government that establish legal prerequisite conditions in order to
— place a medical device on the market,
— make a medical device available for use,
— install a medical device, or
— implement a related service.

Such regulatory requirements are only applicable to an organization if they have entered or plan to enter a particular market or region where such requirements exist. A portion of the management review should be devoted to an understanding of the organization’s regulatory compliance status as well as action plans to ensure such compliance is established and maintained.

from there your auditor request makes sense.
Hope this helps.

[Dee3712]

Supremely useful information...Thanks so much to everyone.

Would you suggest that I add a "standards & regulations review" section to my internal quality audit report form (see attached) OR manage it another way?

[Vincnet]

I was running out of space to say that I solved the issue with a procedure stating that when we want to address a new market, part of the process is to define the specific regulatory requirements of this market and to set-up a specific audit check-list. As our auditor requested us to defined exactly what was assessed a sentence saying that while auditing the said process compliance to MDD or CMDCAS requirements was assessed.
So in my opinion your proposal wouldn't stand. but I might be wrong in my interpretation.
V

[AndyN]

Originally Posted by cclee

Characteristics of Conformance Audit (referenced in ASQ CQA-study Module 1 section C):
"Conformance audits are designed to give assurance that activities have been performed according to stated rules. Such audits do not question the rules themselves but verify implementation of written procedures, requirements, or standards"

What's this but a normal, internal audit?

[cclee]

Originally Posted by AndyN

What's this but a normal, internal audit?

Hi AndyN, not sure if this answers your question but here's the overall quality audit types (sorry its easier to see in a flow chart)

Audit types
Product audit, Process Audit, System Audit

System audits
Internal Audits & External Audits

Internal audits: First-Party Audits =Performance Audits + Conformance audits

External Audits
Second-Party Audits & Third-Party Audits = Conformance audits

ASQ CQA module 1 section C:
“Performance audits assess the effectiveness of an organization’s processes in achieving the organization’s business goals. Where conformance audits are reactive and do not question the rules, performance audits are more proactive and challenge how well the rules contribute to organization business objectives.”

Also, Desk Audit is lower tier document review prior to stark of fieldwork.

Cheers,
cclee